Prepare launcher 0.1.7 for server migration and manual key transition

.github/workflows/build.yml

@@ -3,7 +3,7 @@ name: Cross-platform build
 on:
   workflow_dispatch:
   push:
-    branches: [main]
+    branches: [main, codex/server-migration-20260917]
 
 permissions:
   contents: read

AGENTS.md

@@ -255,3 +255,20 @@ feed were signed with the existing local updater key and verified through
 public HTTPS downloads. See `docs/release-0.1.6.md` and its committed receipt.
 This records successful release/admission verification, not a Windows/macOS
 cold install or OS signing/notarization certification.
+
+## Server migration — launcher 0.1.7 (2026-09-17)
+
+Minigames Quick Play now uses the fixed native endpoint `shacraft.ru:25568`.
+It no longer pins the retired server IP in the application binary. The Fabric
+admission client accepts the new actual socket IP `135.106.219.182` and retains
+`135.106.154.86` for the temporary forwarding path; unrelated hosts and ports
+remain rejected. The server published updated signed companion manifests.
+
+The migration's full-platform packages are prepared on
+`codex/server-migration-20260917`. Existing 0.1.6 installers still connect to the
+old IP and need that forwarding path until upgraded. Version 0.1.7 uses a newly generated operator-held updater key and the fixed
+`https://shacraft.ru/launcher/updates/stable-v2.json` channel. It requires one
+manual installation. Preserve `stable.json` at the last old-key release; never
+replace it with new-key metadata. Subsequent v2-channel releases use the new
+key, kept only at `/home/emil/.local/share/shacraft-updater/production.key`.
+Do not claim publication based on CI packages alone.

admission-client/README.md

@@ -13,7 +13,7 @@ The native launcher supplies `SHACRAFT_ADMISSION_TICKET` and
 The client accepts a CONFIGURATION payload on `shacraft_admission:challenge`
 with three Minecraft UTF strings: server ID (16), nickname (16), nonce (43).
 It verifies server `minigames`, the exact current game nickname and actual
-socket `135.106.154.86:25568`, then signs once with the ephemeral Ed25519 key.
+socket `135.106.219.182:25568` (the previous IP remains accepted during migration), then signs once with the ephemeral Ed25519 key.
 The response on `shacraft_admission:proof` contains ticket (43) and standard
 Base64 signature (88). The transcript has no final newline:
 

admission-client/src/main/java/ru/shacraft/admission/AdmissionProof.java

@@ -62,6 +62,6 @@ public final class AdmissionProof {
         if (allowLoopback && (host.equals("127.0.0.1") || host.equals("::1") || host.equals("[::1]") || host.equals("0:0:0:0:0:0:0:1"))) {
             return port > 0 && port <= 65535;
         }
-        return port == 25568 && (host.equalsIgnoreCase("shacraft.ru") || host.equals("135.106.154.86"));
+        return port == 25568 && (host.equalsIgnoreCase("shacraft.ru") || host.equals("135.106.154.86") || host.equals("135.106.219.182"));
     }
 }

admission-client/src/test/java/ru/shacraft/admission/AdmissionProofTest.java

@@ -23,7 +23,11 @@ class AdmissionProofTest {
             assertThrows(IllegalArgumentException.class,()->AdmissionProof.transcript(v[0],v[1],v[2],v[3]));
     }
     @Test void trustsOnlyMinigamesSocketAndExplicitLocalTests() {
+        assertTrue(AdmissionProof.allowedTarget("shacraft.ru",25568,false));
+        assertTrue(AdmissionProof.allowedTarget("135.106.219.182",25568,false));
         assertTrue(AdmissionProof.allowedTarget("135.106.154.86",25568,false));
+        assertFalse(AdmissionProof.allowedTarget("135.106.219.183",25568,false));
+        assertFalse(AdmissionProof.allowedTarget("135.106.219.182",25567,false));
         assertFalse(AdmissionProof.allowedTarget("135.106.154.86",25567,false));
         assertFalse(AdmissionProof.allowedTarget("127.0.0.1",25568,false));
         assertTrue(AdmissionProof.allowedTarget("127.0.0.1",25570,true));

docs/launcher-architecture.md

@@ -359,3 +359,20 @@ The integration is staged until server authentication, signed profile payload,
 and a newer signed launcher release are deployed and checked together. The
 existing public 0.1.5 binary cannot select the new profile by a website-only
 catalog change. Preserve both catalog entries when publishing either profile.
+
+## Server migration — launcher 0.1.7 (2026-09-17)
+
+Minigames Quick Play now uses the fixed native endpoint `shacraft.ru:25568`.
+It no longer pins the retired server IP in the application binary. The Fabric
+admission client accepts the new actual socket IP `135.106.219.182` and retains
+`135.106.154.86` for the temporary forwarding path; unrelated hosts and ports
+remain rejected. The server published updated signed companion manifests.
+
+The migration's full-platform packages are prepared on
+`codex/server-migration-20260917`. Existing 0.1.6 installers still connect to the
+old IP and need that forwarding path until upgraded. Version 0.1.7 uses a newly generated operator-held updater key and the fixed
+`https://shacraft.ru/launcher/updates/stable-v2.json` channel. It requires one
+manual installation. Preserve `stable.json` at the last old-key release; never
+replace it with new-key metadata. Subsequent v2-channel releases use the new
+key, kept only at `/home/emil/.local/share/shacraft-updater/production.key`.
+Do not claim publication based on CI packages alone.

docs/launcher-updates.md

@@ -1,3 +1,8 @@
+> From 0.1.7, new installations trust the new operator key and use
+> `https://shacraft.ru/launcher/updates/stable-v2.json`. Migration from 0.1.6
+> requires manual installation. Keep the old `stable.json` feed unchanged.
+> For future releases use `stable-v2.json` in publication commands below.
+
 # Signed launcher updates
 
 The application updater is separate from the signed Aeronautics modpack

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "shacraft-launcher-ui",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shacraft-launcher-ui",
-      "version": "0.1.6",
+      "version": "0.1.7",
       "dependencies": {
         "@tauri-apps/api": "2.11.1",
         "lucide-react": "1.41.0",

package.json

@@ -2,7 +2,7 @@
   "name": "shacraft-launcher-ui",
   "license": "MIT",
   "private": true,
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.lock

@@ -3361,7 +3361,7 @@ dependencies = [
 
 [[package]]
 name = "shacraft-launcher"
-version = "0.1.6"
+version = "0.1.7"
 dependencies = [
  "base64 0.22.1",
  "ed25519-dalek",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "shacraft-launcher"
-version = "0.1.6"
+version = "0.1.7"
 description = "ShaCraft Minecraft launcher"
 authors = ["ShaCraft"]
 license = "MIT"

src-tauri/src/launch.rs

@@ -247,7 +247,7 @@ fn build_command(request: &LaunchRequest) -> Result<Command, LaunchError> {
     }
     // This endpoint is native-owned; a manifest cannot redirect game admission.
     if request.admission.server_id() == "minigames" {
-        command.args(["--quickPlayMultiplayer", "135.106.154.86:25568"]);
+        command.args(["--quickPlayMultiplayer", "shacraft.ru:25568"]);
     }
     command.current_dir(request.profile_dir);
 
@@ -313,7 +313,7 @@ mod tests {
             assert!(arguments
                 .windows(2)
                 .any(|args| args == ["--accessToken", "0"]));
-            assert_eq!(arguments.windows(2).any(|pair| pair == ["--quickPlayMultiplayer", "135.106.154.86:25568"]), server_id == "minigames");
+            assert_eq!(arguments.windows(2).any(|pair| pair == ["--quickPlayMultiplayer", "shacraft.ru:25568"]), server_id == "minigames");
             for secret in proof {
                 assert!(arguments.iter().all(|argument| !argument.contains(secret)));
                 for path in [

src-tauri/src/updater.rs

@@ -14,7 +14,7 @@ use tauri::{AppHandle, Manager, Runtime};
 use tauri_plugin_updater::{Update, UpdaterBuilder, UpdaterExt};
 use url::Url;
 
-pub(crate) const UPDATE_ENDPOINT: &str = "https://shacraft.ru/launcher/updates/stable.json";
+pub(crate) const UPDATE_ENDPOINT: &str = "https://shacraft.ru/launcher/updates/stable-v2.json";
 pub(crate) const MAX_METADATA_BYTES: usize = 192 * 1024;
 const MAX_PAYLOAD_BYTES: usize = 64 * 1024;
 pub(crate) const MAX_ARTIFACT_BYTES: usize = 256 * 1024 * 1024;

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ShaCraft Launcher",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "identifier": "ru.shacraft.launcher",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -49,9 +49,9 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDk0N0MzODEwMjg1OUVCNDEKUldSQjYxa29FRGg4bEdKSkFWUzZUNDZhRFN4cGIwL0FvVnl0blhrOWtSMWhSOWxHMkU1aGs5L2oK",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEY3NUEyMDIwOUM3QTFFRTYKUldUbUhucWNJQ0JhOTFnUUo4d0Rmc1JxOVdyRElCYTRranJKRzZEYzloRGNXQ09NL1kvN042OEsK",
       "endpoints": [
-        "https://shacraft.ru/launcher/updates/stable.json"
+        "https://shacraft.ru/launcher/updates/stable-v2.json"
       ],
       "windows": {
         "installMode": "passive"